svn commit: r306082 - head/sys/netinet

[Michael Tuexen]

Author: tuexen
Date: Wed Sep 21 08:28:18 2016
New Revision: 306082
URL: https://svnweb.freebsd.org/changeset/base/306082

Log:
  Fix the handling of unordered fragmented user messages using DATA chunks.
  
  There were two bugs:
  * There was an accounting bug resulting in reporting a too small a_rwnd.
  * There are a bug when abandoning messages in the reassembly queue.
  
  MFC after:	4 weeks

Modified:
  head/sys/netinet/sctp_indata.c

Modified: head/sys/netinet/sctp_indata.c
==============================================================================
--- head/sys/netinet/sctp_indata.c	Wed Sep 21 08:23:33 2016	(r306081)
+++ head/sys/netinet/sctp_indata.c	Wed Sep 21 08:28:18 2016	(r306082)
@@ -809,6 +809,8 @@ restart:
 					tchk = TAILQ_FIRST(&control->reasm);
 					if (tchk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) {
 						TAILQ_REMOVE(&control->reasm, tchk, sctp_next);
+						asoc->size_on_reasm_queue -= tchk->send_size;
+						sctp_ucount_decr(asoc->cnt_on_reasm_queue);
 						nc->first_frag_seen = 1;
 						nc->fsn_included = tchk->rec.data.fsn_num;
 						nc->data = tchk->data;
@@ -5322,6 +5324,9 @@ sctp_flush_reassm_for_str_seq(struct sct
 		/* Not found */
 		return;
 	}
+	if (old && !ordered && SCTP_TSN_GT(control->fsn_included, cumtsn)) {
+		return;
+	}
 	TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
 		/* Purge hanging chunks */
 		if (old && (ordered == 0)) {